KV plugin filter not working

Elastic Stack Logstash
1

This is my config filter
grok {
match => { "message" => "<%{INT:number}>%{SYSLOGTIMESTAMP:timestamp}%{SPACE}%{NOTSPACE:app}%{SPACE}%{NOTSPACE:logsource}[%{WORD:status}]%{SPACE}%{INT:eventid}%{SPACE}%{GREEDYDATA:mess}.%{SPACE}%{GREEDYDATA:service}:%{SPACE}%{GREEDYDATA:wininfo}"}
}
kv {
source => "wininfo"
value_split => ":"
field_split => "\x7f+"}
}

Character "\x7f" is DEL character, it seperates the pairs. But kv not working at all. Thanks for any helps

2

field_split takes only a single character. You need to use field_split_pattern which takes a regex.

3

I am using logstash 6.1.0, and this is my ERROR when use split pattern
[ERROR][logstash.filters.kv ] Unknown setting 'field_split_pattern' for kv
I checked the document about KV filter, I don't understand why it is false.

4

You can update the plugin by running logstash-plugins update logstash-filter-kv or just update all plugins with logstash-plugins update

1 Like
5

Okay thanks. I solved it

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.